CVE-2026-18597

{"id": "CVE-2026-18597", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18597", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T12:30:02.936471Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "14984358-7092-470d-8f34-ade47a7658a2", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "14984358-7092-470d-8f34-ade47a7658a2", "affectedData": [{"vendor": "Foxit Software Inc.", "product": "Foxit PDF Services API", "versions": [{"status": "affected", "version": "before 2026-07-27"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-06T08:16:29.633", "references": [{"url": "https://www.foxit.com/support/security-bulletins.html", "source": "14984358-7092-470d-8f34-ade47a7658a2"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "14984358-7092-470d-8f34-ade47a7658a2", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure."}, {"lang": "es", "value": "La funci\u00f3n de creaci\u00f3n de PDF de la API de Foxit PDF Services admite hacer referencia a archivos externos. Aunque el acceso a archivos locales est\u00e1 restringido, un atacante podr\u00eda desencadenar una vulnerabilidad SSRF al usar la redirecci\u00f3n de URL para eludir la validaci\u00f3n, lo que lleva a la revelaci\u00f3n de informaci\u00f3n."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2"}